How to Script IPTable Rules for Enterprise Ubuntu Servers

Stop Typing Rules Manually Before You Break Something

Let’s get one thing straight. If you are still typing firewall rules one by one on a production server, you are playing Russian roulette with your infrastructure. One typo? Boom. You just locked the entire engineering team out of the database. Writing a solid iptables bash script isn't just a flex. It is a survival skill for enterprise firewall automation. You need repeatability. You need version control. Most importantly, you need a way to nuke the rules and start over when things go sideways.

The "Drop Everything" Baseline

Good security starts with paranoia. The golden rule of ubuntu iptables? Trust absolutely nothing. Your script needs to flush out all the old junk first. Wipe the slate clean. Then, set the default policy to DROP. For everything. Inbound, outbound, forward. Shut the front door, the back door, and the windows. Sure, it breaks your server completely for about two seconds. That’s exactly what we want. We build the walls first, then we cut out the doors.

Don't Lock Yourself Out (The SSH Lifeline)

Read this twice. Before you add any fancy application rules, allow SSH. I cannot tell you how many times I've watched a junior admin execute an iptables bash script and immediately lose connection. Panic ensues. To prevent that heart attack, explicitly allow port 22 right at the top of your script. Actually, go a step further. Restrict that SSH access to your specific management IP block. Enterprise environments don't leave port 22 flapping in the wind for every script kiddie scanning AWS IP ranges.

Punching Holes for the Money Makers

Now we let the traffic flow. But only the traffic that pays the bills. Web servers need 80 and 443. Your internal APIs might need 8080. Here's the thing. Keep these rules grouped logically in your script. Use variables. Don't hardcode IP addresses fifty times down the page. Define your web server IPs at the top, then reference the variable. It makes reading your enterprise firewall automation script infinitely easier when your boss asks for an audit at 4:45 PM on a Friday. Oh, and don't forget to allow established and related connections. Dropping return traffic is a rookie mistake.

Making It Survive a Reboot

You wrote the script. You ran it. Everything works perfectly. Then the underlying host gets patched, the server reboots, and you are back to zero. Painful. Ubuntu doesn't save iptables rules by default. You have to tell it to. Install iptables-persistent. At the very end of your bash script, pipe the current running config into /etc/iptables/rules.v4. Now your rules are baked in. They survive the reboot. You survive the weekend.